2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345N.exe
Size 236KB
Sample250127-s8rlbswpdm
SHA256 2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345
MD5 2d81c320aa205a32be9d04080602de10
SHA1 04b2a22a800060809b4f4fe899706be0e889f7eb
SHA512 8f33fcb3f2e87c24215db05985f2d6a8320b058ee667e298c3f76778c3ad28aefe438e7ced29f5980dea70b0258a9c32ab7057e1f5d4ed675aa5ba83225caedc
SSDEEP 3072:3J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/c/FnncroP9:ZwDeM7iNEkgiOb31k1ECqJ/F
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3060-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3060-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b000000023b87-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345N.exe

C:\Users\Admin\AppData\Local\Temp\2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345N.exe
"C:\Users\Admin\AppData\Local\Temp\2d6bac1099ece8202eab1fc802022cb6b73fda479fa2b17671b8f7520e177345N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-dyUWYwrjgRTrBSxl.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-dyUWYwrjgRTrBSxl.exe
Size 236KB
SHA256 b8bdee9a8973a46c171124d496738b218778d01ceb0b4a6c49d388e1ba89e58b
MD5 13000e7652c6a0691f9f49101aff45f5
SHA1 6725ac34863b374f7a86573c33e6170c676f15e7
SHA512 908796085d6836da6cdefd29fe29d3e75e7d857c693881e9a31ff176001066e73e4bb49ec96dc406ec5acbeb0bc0156f09007ec8d1108e1369a063dbeec47005
SSDEEP 3072:3J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/l/FnncroP9:ZwDeM7iNEkgiOb31k1ECRJ/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3060-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3060-1-0x0000000000400000-0x000000000043B000-memory.dmp